"""add webauthn_credentials table

Revision ID: h8i9j0k1l2m3
Revises: g7h8i9j0k1l2
Create Date: 2026-05-18 00:00:00.000000

Stores WebAuthn (passkey) credentials per user.
Each user can register multiple passkeys (e.g. phone, laptop, YubiKey).

Columns:
  credential_id     -- base64url-encoded credential ID from the authenticator
  public_key        -- COSE-encoded public key bytes (base64url)
  sign_count        -- monotonically increasing counter for clone detection
  transports        -- JSON list of transport hints (e.g. ["internal", "hybrid"])
  aaguid            -- authenticator AAGUID (UUID string) for attestation metadata
  name              -- user-assigned friendly name (e.g. "iPhone 15")
  created_at        -- registration timestamp
  last_used_at      -- last successful authentication timestamp
"""
from alembic import op
import sqlalchemy as sa
from sqlalchemy.dialects import mysql


revision = 'h8i9j0k1l2m3'
down_revision = 'g7h8i9j0k1l2'
branch_labels = None
depends_on = None


def upgrade():
    op.create_table(
        'webauthn_credentials',
        sa.Column('id', mysql.INTEGER(unsigned=True), autoincrement=True, nullable=False),
        sa.Column('user_id', mysql.INTEGER(unsigned=True), nullable=False),
        sa.Column('credential_id', sa.String(512), nullable=False),
        sa.Column('public_key', sa.Text, nullable=False),
        sa.Column('sign_count', sa.BigInteger, nullable=False, server_default='0'),
        sa.Column('transports', sa.String(255), nullable=True),
        sa.Column('aaguid', sa.String(64), nullable=True),
        sa.Column('name', sa.String(128), nullable=False, server_default='Passkey'),
        sa.Column('created_at', sa.DateTime, nullable=False),
        sa.Column('last_used_at', sa.DateTime, nullable=True),
        sa.ForeignKeyConstraint(['user_id'], ['users.id'], ondelete='CASCADE'),
        sa.PrimaryKeyConstraint('id'),
        sa.UniqueConstraint('credential_id', name='uq_webauthn_credential_id'),
    )
    op.create_index('ix_webauthn_credentials_user_id', 'webauthn_credentials', ['user_id'])


def downgrade():
    op.drop_index('ix_webauthn_credentials_user_id', table_name='webauthn_credentials')
    op.drop_table('webauthn_credentials')